feat: T4 wave 4 - rules suggest, takeover, chains, autopilot A1-A3, suggestions page, varroa bands UI

- Automation rules propose suggestions instead of creating tasks;
  notify per rule config; corrected varroa measurements refresh or
  resolve their suggestion
- Inspection values can be taken over into the colony card
  (occupiedFrames 0-40, strength deprecated); warning counts use the
  same visibility rule as the notification list
- Biotech chains: swarm check after queen cells, queen acceptance
  check, split schedules (raise own, queen cell, queen)
- Season autopilot core with A1 inspection due, A2 varroa measurement,
  A3 recheck after treatment; colony sync and daily step
- Frontend: suggestions page with groups, bulk accept, undo, paging,
  focus management and permission gating
- Frontend: varroa traffic light from seasonal bands, sample size,
  one range request for the colony chart
- Notifications: mark-read answers 404 for rows the user may no
  longer see

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/notifications/notifications.service.ts

@@ -168,8 +168,19 @@ export class NotificationsService {
       .map(toView);
   }
 
-  /** One statement; a foreign or unknown id matches nothing and answers 404. */
+  /**
+   * A foreign, unknown or no longer visible row (same rule as findOwn)
+   * answers 404 and is left untouched.
+   */
   async markRead(id: string, userId: string): Promise<NotificationView> {
+    const row = await this.prisma.notification.findFirst({
+      where: { id, userId },
+      select: { requiredPermissions: true },
+    });
+    const held = await this.permissionResolver.getPermissions(userId);
+    if (!row || !row.requiredPermissions.every((key) => held.has(key))) {
+      throw new NotFoundException('Notification not found');
+    }
     const { count } = await this.prisma.notification.updateMany({
       where: { id, userId },
       data: { read: true },
@@ -183,9 +194,21 @@ export class NotificationsService {
     });
   }
 
+  /** Marks only the unread rows the user may see. */
   async markAllRead(userId: string): Promise<{ updated: number }> {
-    const { count } = await this.prisma.notification.updateMany({
+    const unread = await this.prisma.notification.findMany({
       where: { userId, read: false },
+      select: { id: true, requiredPermissions: true },
+    });
+    const held = await this.permissionResolver.getPermissions(userId);
+    const visible = unread
+      .filter((row) => row.requiredPermissions.every((key) => held.has(key)))
+      .map((row) => row.id);
+    if (visible.length === 0) {
+      return { updated: 0 };
+    }
+    const { count } = await this.prisma.notification.updateMany({
+      where: { id: { in: visible }, userId, read: false },
       data: { read: true },
     });
     return { updated: count };